You download an app on your smartphone to make purchases online. And it not only keeps track of what you’re looking for and what you’re ordering, but it also accesses your cell phone file and keeps track of all other searches and purchases it makes from competing apps.

And that’s not all: its malware is capable of reading private messages, intercepting and downloading personal files such as photos, and is extremely difficult to remove once downloaded and used.

An unprecedented discovery was made by international software security services for the Chinese online shopping app Pin Duo Duo or Pinduoduo, revealing aspects of malware allegedly used by the company, which experts say is unprecedented.

Pinduoduo is one of the most popular shopping apps in China, selling clothes, supermarket products and almost everything to more than 750 million users in China, and has also spread internationally to numerous US customers. However, according to cybersecurity experts, it can also bypass the protection of its users’ mobile phones.

During a special investigation by CNN on this matter, many cybersecurity experts from Asia, Europe and the United States found malware in the Pinduoduo application that exploits vulnerabilities in Android operating systems.

At the same time, employees of the Chinese company said that the weaknesses of the systems were used to spy on users and competitors, apparently in order to increase sales.

“We’ve never seen a popular app like this try to elevate their privileges to access things they shouldn’t have access to,” said Mikko Hipponen, principal investigator at Finnish cybersecurity company WithSecure. “This is very unusual and quite dangerous for Pinduoduo,” he added.

The revelations come at a time when Chinese apps, and especially the most famous one, TikTok, are under scrutiny by US and European authorities.

There is currently no indication that Pinduoduo is offering Chinese authorities any of the data it collects with the alleged malware. However, it is assumed that, like all other companies operating in China, it may at some point be forced to provide Chinese authorities with access to all of its data.

Source: CNN, Reuters.